Revision as of 08:35, 11 April 2019

Contents

Configuration

This will allow you to run scripts from a remote machine against RouterOS using Public/Private key authentication.

Host to RouterOS

Given example commands are run using FreeBSD - should be similar on other platforms.

1) Create a key using ssh-keygen

%ssh-keygen -t dsa

This creates a DSA key pair that is compatible with Mikrotik.

Generating public/private dsa key pair.
Enter file in which to save the key (/home/user/.ssh/id_dsa):
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in /home/user/.ssh/id_dsa.
Your public key has been saved in /home/user/.ssh/id_dsa.pub.
The key fingerprint is:
f0:d0:xx:ee:07:xx:bb:a8:xx:9e:e1:fe:77:48:xx:xx user@vp6.example.com

Note: Make sure to leave the passphrase blank if you are going to be using this key in automated scripts. You do not want to be prompted for a password. Just make sure you keep your private key private (enough said?)!

The user field above determines which user account will be logged in when you pass the key. For security reasons you should never use the 'admin' account (you knew that right?). Create a separate user account.

Now that you've created a key pair and imported the public key into RouterOS you can start running commands from your remote machine.

Note: If you wish to be able to run ssh / ssh-exec commands from one RouterOS device to another, follow the additional steps below

RouterOS to RouterOS

4) Create a new group with policies:

/user group add name=remote policy=ssh,read,write

5) Create a new user and assign the previously created group:

/user add name=remote group=remote password=Sup3rStr0ngPassw0rd

6) Upload private and public keys on the device, from which you wish to use ssh commands with DSA authentication

Now you should be able to authenticate from this device to any other device which has a user with the imported public key

Note: Ensure that "/ip ssh set always-allow-password-login=no" is set so SSH-key is used

Escaping shell special characters

For executing a simple command with ssh you have to enclose command with quotes to tell shell which characters belong to single shell command parameter. If you use double quotes then you have to escape all inside double quotes with backslash \.

DSA deprecated

Since OpenSSH 7.0 version DSA public key algorithm is considered weak and is deprecated. To be able to use DSA it needs to be enabled explicitly. Put PubkeyAcceptedKeyTypes +ssh-dss to ~/.ssh/config file.

Also to be able to connect to older versions of RouterOS you may need to use additional ssh parameters -o KexAlgorithms=diffie-hellman-group14-sha1 -o HostKeyAlgorithms=+ssh-dss